Cyber-Boss Tweed
21st Century Ballot-Tampering Techniques

With old-style voting systems, for the most part, no special training was needed to realize something was amiss. Not so with rigging computers, but many public officials don’t understand this.
“Subverting elections would be extremely unlikely and staggeringly difficult,” said Georgia Secretary of State Cathy Cox when interviewed about Georgia’s touch-screen voting system. “It would take a conspiracy beyond belief of all these different poll workers. … I don’t see how this could happen in the real world.”

My premise, though, is this: An insider, someone with access, can plant malicious computer code without getting caught. Just as we know that banks will have robbers, that blackjack tables will have card-counters and that embezzlers will slip in amongst the beancounters, so we should expect to find a few ethically challenged individuals among the honorable programmers and technicians who work with our voting machines.

Certainly, human nature did not change just because we entered the age of computers. Sooner or later, someone’s going to try to steal votes on these things.

What kind of cheaters are we looking for?
Candidates may not be the most likely people to cheat. Few candidates are likely to possess the combination of motive and cash to rig their own election. I believe that vested interests behind the candidate are more likely suspects, and the candidate need not even know.

Zealots are a bigger danger, especially if they happen to be connected to people with giant wallets. “True believers” may feel that the end justifies any means. Some are very wealthy, and some congregate in radical groups where they can pool their cash and push their agenda. Zealots of any kind may believe they are “helping” the rest of us by imposing their candidates on us. You do not need to hand a zealot a bribe, and the candidate they select never needs to know his election was rigged.

Gambling interests may not be squeamish about pulling strings. Gambling rights have turned into a brawl, with some tough players who are seeking riverboat gambling rights, the right to compete with Native American casinos and just plain liberalized and legalized gambling in communities all over the world.

Hackers, more accurately called “crackers,” get their kicks by compromising legitimate software systems. These people may not need bribe money or a cause; like climbing a mountain, they just want to see if they can do it.

Profiteers can make billions by putting the right candidate into office. Electronic voting systems give a small number of people access to a great number of votes. If you control the counting software, ballot-tampering on a massive scale is possible. We should expect this to attract the all-star players.
In the old days, a city boss might want a particular candidate to win, perhaps throw a few construction contracts his way, take a kickback. But high-volume tampering provides a motive for a different clientele.

Defense contractors stand to make billions with the right candidate. Oil companies benefit from new pipelines all over the world, if they select candidates likely to vote for open exploration and geopolitically
strategic development. Highway contractors garner hundreds of millions on freeway and bridge projects. Global financiers gain power and profit when international trade policies are set up to favor their interests.
Pharmaceutical companies want legislative protection for pricing policies and product patenting and protection from international competition. Investment holding companies stand to gain control over
privatized retirement and pension funds.

So much to spend, so few techies to corrupt. Where to begin?
Well, for starters, you could send your own compromised programmer into a voting machine company toting a resume. But suppose I am a political operative for a wealthy and powerful, but crooked, corporation, and I just want to buy off an employee. How would I find and contact an employee, and how would I know whom to approach? I set out to answer that question. I figured that if a middle-aged woman like me who has never done a “covert op” in her life, working on the Internet, could find the people who program our voting machines, then certainly the bad guys must know who they are. You can find software engineers who once worked for voting machine companies by looking at online resumes and job-search sites. The resumes often have home phone numbers. You can call them up, say you are writing an article and ask them how a machine can be rigged. And they will tell you. I know this because I did it.

You will find software engineers who currently work for voting machine companies by finding any company e-mail address. ES&S employees have e-mail addresses that end in “essvote.com.” Enter “essvote” in a search engine, and you’ll find people who submitted information to high-school reunion sites and programmers who post comments on forums, join listservs, create personal Web pages and
post their wedding plans on the Internet. One guy even listed his hobbies and his favorite vacation spots.
I located eight dozen voting-company employees this way. I also found the home phone number for someone in human resources at ES&S, who in turn has access to contact information, including the
home phone number, for every single employee. This took three hours. How would you choose someone to approach? For $80 you can run a background check. That will give you a person’s Social Security number, which opens up more information. You can also run a credit check. Doing this, you find out if the
programmer has a gambling problem, has gotten into credit-card debt, is over her head in student loans, has had run-ins with the law, likes fancy cars, is overcommitted on a mortgage. Additional searches reveal
political affiliations and even lead you to people who are disgruntled or believe they will soon be fired.

How to compromise an Internet voting system

Some cities, like Manatowoc, Wisconsin, and Liverpool, England, are eager to vote by Internet. Among computer professionals, however, Internet voting advocates are difficult to find. Here’s why: Companies like VoteHere claim that encryption techniques are a key to Internet voting security, but encryption won’t protect our vote from software programming errors. Rigging an Internet election is as simple as “DoS”-ing a server. Denial of Service attacks can knock out servers in targeted areas, and no amount of encryption will help. (Let’s take the technospeak out: Suppose you connect to the Internet using America Online, but
on election day, for some reason, your AOL access numbers don’t work. Can you vote on the Internet?)
A company that specializes in Internet voting, election.com, ran a January 2003 contest in Toronto, Canada, which was disrupted by a malicious attempt to shut down the computer system.
“Earl Hurd of election.com said he believes someone used a ‘denial of service’ program to disrupt the voting — paralysing the central computer by bombarding it with a stream of data,” CBC News reported. “‘We had one log-in attempt that corrupted the ability of everybody to get access to our servers,’ he said ... When asked if a second ballot might be delayed by another act of computer vandalism, election.com conceded that the culprit might strike again. “‘Unless he died in the last few minutes because of the evil thoughts in my brain, he or she is still out there,’ Hurd said.”

Even the most elaborate encryption can’t solve a power outage. If some clown with a backhoe pulls the phone cables up out of the ground, how will you vote? If an ice storm takes out power in the city, will your modem work? If you forget to pay your cable bill and they turn it off on Election Day, what will you do?
If you can vote from the privacy of your home, you can sell that vote as well. Proof of how you voted would be as close as your printer. And while we’re talking about privacy, what if you neglect to put
in the latest Microsoft patch? You know, the one that says “A security issue has been identified that could allow an attacker to compromise a computer running Windows XP and gain control over it.”
Heck, if there is as much “spyware” out there as my spam claims,Internet voting would mean big trouble. From what I can tell, a lot of people don’t trust the privacy of their computer even when they
are not doing something mission-critical, like casting a vote. Even if scientists make a safe system, how do we get everyone to trust it? You might find other people voting for you. Read up on identity theft, which is getting worse every year.

Dirty tricks will proliferate. Your elderly Aunt Martha may get convincing messages that send her to bogus voting sites which dispose of her vote. Come to think about it, beloved Aunt Martha is eighty-three years old. Learning to vote on the Internet might stress her out, and why should she have to? Do you want to vote with your spouse looking over your shoulder? Many of us connect to the Internet at work: Do you really want to cast your vote next to your union leader or your boss? And what about “technical difficulties?” You cast your vote and your computer screen turns blue and a message appears:
Iexplorer.exe has caused a general protection fault in vote.exe. Your system may be unstable. Save all your work, close all windows and reboot your system.
Oookay. Did your vote go through? How will you know? If it didn’t, will you be able to vote again? If you do and the same thing happens, then what? Where will we find enough people to staff the tech support desks on Election day? Will we farm the job out to a service company in Bombay? And if so, how secure is that? People are out there pushing Internet voting, but this concept is flawed and cannot be repaired. Any money we would save closing down the polls would be lost trying to make the system secure and
reliable, and new laws would have to be passed to deal with each problem that arises. People and agencies would have to be appointed to enforce those laws. Election law would come to resemble the tax
code in complexity. Bottom line? Voting for your favorite movie online may be cool,
but it’s no way to run the Republic.